Secure 2FA with TOTP and zk-SNARKs
In our pursuit of enhancing security within blockchain applications, we've integrated a Two-Factor Authentication (2FA) system using Time-based One-Time Passwords (TOTP) verified through Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs). This approach ensures the authenticity of transactions and actions without compromising user privacy. Furthermore, all user and system data related to 2FA are securely stored in an append-only database using Conflict-Free Replicated Data Types (CRDTs) backed by IPFS DAGs, ensuring data integrity and resilience.
Overview
TOTP System
The TOTP system generates a temporary code based on a shared secret and the current time. This method is widely used for 2FA, providing an additional layer of security beyond just passwords.
Secret Generation: Upon account creation, a unique secret is generated for each user.
TOTP Generation and Verification: The TOTP is generated by the user's device and verified by our system to grant access or validate transactions.
zk-SNARKs Integration
zk-SNARKs allow the verification of possession of the TOTP without revealing the TOTP itself or the shared secret, maintaining user privacy.
Proof Generation: Users generate a zk-SNARK proof that they have a valid TOTP.
Proof Verification: Our system verifies this proof without needing to see the actual TOTP code.
CRDT Database with IPFS DAG
User account information, including 2FA details, is stored in a CRDT database. This structure supports an append-only model, ensuring data is tamper-resistant and decentralized.
Immutable Storage: Using IPFS DAG, the database ensures that once data is added, it cannot be altered or removed.
Decentralization and Resilience: Leveraging IPFS provides a distributed network, enhancing data availability and resilience against attacks or failures.
Implementation Steps
Account Setup
Generate TOTP Secret: Upon account creation, generate a TOTP secret for the user.
Encrypt and Store Secret: Encrypt the secret with the user's public key and store it in the CRDT database, along with the account information.
TOTP Verification with zk-SNARKs
Generate TOTP: The user generates a TOTP on their device.
Create zk-SNARK Proof: The user generates a zk-SNARK proof of having a valid TOTP.
Submit Proof: The user submits the proof for verification.
Verify Proof: Our system verifies the proof, granting access or approving transactions without ever seeing the TOTP code.
Data Storage in CRDT with IPFS DAG
Store Account Information: Account and TOTP information are stored in the CRDT database.
Append-Only Model: Any updates are appended, maintaining a historical record of changes.
IPFS DAG Storage: The CRDT database is stored in an IPFS DAG, ensuring decentralized, immutable storage.
Security Considerations
Key Management: Secure management of private keys used for encrypting TOTP secrets is crucial.
Proof Verification: Ensure that zk-SNARK proof verification is robust and secure.
Data Integrity: Regular audits and checks to ensure the integrity and availability of data stored in the CRDT database on IPFS.
Conclusion
Integrating TOTP with zk-SNARKs and leveraging a CRDT database with IPFS DAG for storage offers a robust, privacy-preserving 2FA solution. This system enhances security for blockchain applications while ensuring data integrity and user privacy.
Last updated